Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
132s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
12/05/2024, 16:35
Static task
static1
Behavioral task
behavioral1
Sample
SCAN_814216796997US_May_11_2019.js
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
SCAN_814216796997US_May_11_2019.js
Resource
win10v2004-20240426-en
General
-
Target
SCAN_814216796997US_May_11_2019.js
-
Size
4KB
-
MD5
ddea80fd1df1098ed6465f835554e639
-
SHA1
3e27ffd7c2bcb4fdd2af9a0adda0dc47dd7470c6
-
SHA256
2b695b354e1485292556309baf5e876b4a7ba956bedf9c2bfab60b3ecbe625c8
-
SHA512
b5f67de8b4320bf1eb299b013a4c3922883df77ba73986960d080263d00ad77cb6b623057dce1e93e654e3640683d8cfebeeed0ca5b2d4c64ee73f8fd86056ff
-
SSDEEP
48:YFpkufv1+YuUIxJ3+4EYoOVOEBtXZpzKHFIqgAiXXZnTLMn6uoL/xkVB3EiYPmv4:Yf3v1+akETwjqgps4GEPmeV
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 9 1236 wscript.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation wscript.exe -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
114B
MD5e89f75f918dbdcee28604d4e09dd71d7
SHA1f9d9055e9878723a12063b47d4a1a5f58c3eb1e9
SHA2566dc9c7fc93bb488bb0520a6c780a8d3c0fb5486a4711aca49b4c53fac7393023
SHA5128df0ab2e3679b64a6174deff4259ae5680f88e3ae307e0ea2dfff88ec4ba14f3477c9fe3a5aa5da3a8e857601170a5108ed75f6d6975958ac7a314e4a336aed0